I wrote:
> We have a very old AFS cell, installed with kaserver back in 1991,
> and we later migrated to use heimdal instead of kaserver. This was
> working well with Debian sarge installations, which were our standard
> setup until recently. When we started upgrading some of our clients
> to Debian etch (libpam-heimdal moves from 1.0-17 to 2.5-1), we're
> seeing problems with some people getting failed login problems
> repeatedly (in /var/log/auth.log we see 'Failed password for xxx').
> If we change the pam library from libpam-heimdal to the MIT-based
> libpam-krb5 (version 2.6-1), there are still some failures, but
> not as many.
Love Hörnquist Åstrand wrote:
> Is it any corresponding error in the KDC log ?
Interesting that you should ask this. We are running Debian's
heimdal-kdc version 0.7.2.dfsg.1-10 on three servers, with the
slaves synchronised by iprop. Recently we had a problem on the
slaves, in which the (binary) log file filled up /var, becoming
over 3gb in size. The logs on the master server did not grow in
this way, but I do find a lot of errors there in the text log file.
First there are a _lot_ of errors of this type:
Server not found in database: afs/cellname@REALMNAME: No such entry in the database
where I've replaced the reall cell and realm names. There are 1480
of these errors in the last 24 hours. There there are several hundred
thousand errors in this period of the form
UNKNOWN -- user@REALMNAME: No such entry in the database
These are caused by people logging into local windows boxes, which
are apparently trying to do a kerberos login by default. There
are many lines of the following forms:
Lookup user@REALMNAME succeeded
Lookup krbtgt/REALMNAME@REALMNAME succeeded
Lookup afs@REALMNAME succeeded
There are about 30-odd lines in the day which say one of these:
Server has no support for etypes
Server (krbtgt/REALMNAME@REALMNAME) has no support for etypes
And the rest of the messages in the log file are fairly sensible.
Is it normal to have over 2 million lines per day in the log file?
There are 7769 lines about using various enctypes:
4019 Using des-cbc-crc/des-cbc-crc
2648 Using des-cbc-md5/des-cbc-md5
923 Using des3-cbc-sha1/des-cbc-crc
103 Using des3-cbc-sha1/des-cbc-md5
57 Using aes256-cts-hmac-sha1-96/des-cbc-crc
15 Using aes256-cts-hmac-sha1-96/des-cbc-md5
4 Using des3-cbc-sha1/des3-cbc-sha1
Because of the usage of the system, it's pretty hard to
locate particular failures. Here are two I think might correspond.
In the log from sshd I find:
Mar 12 09:57:04 hostname sshd[26414]: Failed password for username from ipaddress port 1084 ssh2
and at the same time in heimdal-kdc log I find:
AS-REQ username@REALMNAME from IPv4:ipaddress for krbtgt/REALMNAME@REALMNAME
Using des-cbc-crc/des-cbc-crc
Requested flags: renewable_ok, proxiable, forwardable
sending 493 bytes to IPv4:ipaddress
AS-REQ username@REALMNAME from IPv4:ipaddress for krbtgt/REALMNAME@REALMNAME
Using des-cbc-crc/des-cbc-crc
Requested flags: renewable_ok, proxiable, forwardable
sending 493 bytes to IPv4:ipaddress
To me this looks as though the login ought to have succeeded.
Any clarification welcome.
-- Owen